17

Recently I was trying to find why out Windows 10 updates were failing on my computer. The Driver Verifier utility indicated a problem with dcrypt.sys, a file that had been left in %systemroot%\system32\drivers even after I had uninstalled DiskCryptor several years ago.

I made the mistake of deleting dcrypt.sys myself, but when I did that, Windows stopped loading. My inference is that, despite its being third party software, its presence was somehow required by the Windows startup sequence. (I ended up solving this by reinstalling Windows completely.)

What would have been the proper way to get rid of such a file?

I say Reinstate Monica
  • 26,651
adam.baker
  • 283

3 Answers3

23

If you prefer a GUI method, use Microsoft's Autoruns for Windows. It requires no installation. Simply run it elevated, then navigate to the Drivers tab, clear the checkmark next to the driver you wish to disable, then reboot the computer:

enter image description here

Not only is this a simple way to enable/disable drivers and services (along with pretty much anything else that starts automatically in Windows), but it's very easy to undo changes if you find they have unwanted consequences or you're simply experimenting with your configuration.

By the way, the next time you disable a critical startup item and Windows will not boot, try using System Restore. It is capable of restoring the driver file you deleted as well as any Registry settings you might change (including changed made by Autoruns) in an effort to disable it.

Windows automatically creates Restore Points when certain critical actions are about to be taken (such as before installing Updates), but it's a good idea to create one manually before making changes to important startup items. And if your system fails to boot and you need to use a Restore Point, here are directions on how to do that.

I say Reinstate Monica
  • 26,651
7

Apparently /enum-drivers is a windows 10 option and not windows 7 or 8.1

In Windows 7 and 8.1 its just -e not --enum-drivers

From and administrative command prompt:

pnputil /enum-drivers

Find the driver on the list, get the name of the INF file.

pnputil /delete-driver oem0.inf

Windows 7,8.1

pnputil -d oem0.inf

change oem0.inf to whatever you discovered windows named it in the step above.

If windows was broken and didn't start.

Boot off the windows install media

Use F10 (or maybe F8) to get to a command prompt

do a dir command on each letter until you find the windows folder.

dir c: dir d: dir e: ....

Find the offending driver.

dism /image:d:\ /Get-Drivers

replace something.inf with the offending driver name.

dism /image:d:\ /remove-driver /driver:something.inf
cybernard
  • 14,924
3

Start regedit. In the left pane, navigate to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

Now look for a subkey under services called dcrypt.

  • If it’s not there, look for something of a similar name, like dskcrypt.

  • If you still can’t find it, use regedit’s Find command to search for dcrypt.sys in a subkey under Services. The string dcrypt.sys should be in a value called ImagePath.

When you find the key, navigate to it and check that you do indeed see ImagePath: ...dcrypt.sys in the right pane. Now double-click the value called Start and change it to 4, which means Disabled.

That should do it.

Jamie Hanrahan
  • 24,326